Improved sanitization for Friends component database methods

- All integer lists for IN clauses are run through wp_parse_id_list()
- Search terms now escaped in the correct order

Also adds unit tests for touched methods

Fixes #4993

Props johnjamesjacoby

git-svn-id: https://buddypress.svn.wordpress.org/trunk@7026 cdf35c40-ae34-48e0-9cc9-0c9da1808c22